TLDR Tech / InfoSec
A 27-Year-Old Authentication Bypass in OpenBSD's PPP Stack
Argus disclosed a PAP authentication bypass in OpenBSD's sppp(4) subsystem, where sppp_pap_input() in sys/net/if_spppsubr.c fed attacker-controlled length fields straight into bcmp, so a PPPoE peer sending name_len=0 and passwd_len=0 made both comparisons return 0 and complete authentication with no credentials, while oversized lengths triggered a kernel heap over-read. Reachable unauthenticated over the PPPoE data path (pppoe_data_input → pppoeintr → sppp_input → sppp_pap_input), a rogue server in the same broadcast domain can impersonate a legitimate endpoint and route a victim's traffic through it. The flaw dates to the 1999 FreeBSD-derived import and was verified against OpenBSD 7.6 (amd64). The fix, committed by mvs on June 14 (openbsd/src@076e2b1), adds the exact-length pre-check the CHAP handler already used, so administrators running PPPoE links on sppp(4) should pull the patched source and rebuild.
Read the full story